FBI Warns of Ongoing FortiBleed Attacks Locking Out FortiGate VPN Admins

The FBI reports that attackers continue to exploit the FortiBleed vulnerability to deny legitimate administrators access to Fortinet devices.

Threat Times Intrusion DeskOctober 9, 20262 min read

Share LinkedIn Reddit

Illustration: A black network firewall sits on a cluttered desk, its small display screen completely blank and dark. — AI-generated illustration: Threat Times

Key points

The FBI confirms that FortiBleed attacks remain active and ongoing.
Attackers are targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways.
The primary goal of these intrusions is to lock out legitimate system administrators.

The Federal Bureau of Investigation has issued a warning that attacks exploiting the FortiBleed vulnerability are still ongoing. According to BleepingComputer, the FBI states that these campaigns specifically target exposed Fortinet FortiGate firewalls and SSL VPN gateways to lock out legitimate administrators.

The core of this threat involves adversaries leveraging the memory disclosure flaw to gain unauthorized control over network security appliances. Once inside, the attackers proceed to disable or lock out the credentials of authorized users. This denial-of-service tactic effectively prevents security teams from managing their own infrastructure, leaving the compromised devices vulnerable to further exploitation or data theft. The FBI’s alert highlights that this is not a historical issue but a current, active campaign requiring immediate attention from network operators.

Context and Background

FortiBleed refers to a critical memory disclosure vulnerability within Fortinet’s FortiOS and FortiProxy operating systems. While the initial discovery and patching of the flaw occurred previously, the FBI’s latest communication indicates that a significant number of devices remain vulnerable or were not patched in time. Attackers have capitalized on this window of exposure to conduct widespread scanning and exploitation.

The persistence of these attacks suggests that threat actors are systematically scanning the internet for unpatched FortiGate units. The use of SSL VPN gateways as an entry point is particularly dangerous because these services often face the public internet, increasing the attack surface. By locking out administrators, attackers ensure they maintain persistent access without immediate detection or remediation by the organization’s security staff.

Who Is Affected

Organizations using Fortinet FortiGate firewalls and SSL VPN gateways are the primary targets of this ongoing campaign. The FBI’s warning applies to any entity that has these devices exposed to the internet, particularly if they have not verified that their firmware is up to date. Small and medium-sized businesses, as well as large enterprises, are at risk if their perimeter security devices are running vulnerable versions of FortiOS or FortiProxy.

The impact is most severe for organizations that rely on these devices for remote access or network segmentation. If an administrator is locked out, the organization loses visibility into network traffic and cannot enforce security policies. This creates a critical operational blind spot during an active intrusion.

What should you do?

Security professionals should immediately verify the patch status of all Fortinet devices. According to the FBI, the attacks are ongoing, meaning unpatched systems are being actively targeted. Organizations should review access logs for signs of unauthorized administrative changes or lockouts. If a device is found to be compromised, it should be isolated from the network to prevent lateral movement.

What to do and how to stay safe: Fortinet

Audit all Fortinet FortiGate and SSL VPN devices to ensure they are running the latest patched firmware versions provided by the vendor.
Review administrative access logs for evidence of unauthorized lockouts or credential changes that could indicate a FortiBleed exploitation.
Implement network segmentation to limit the exposure of SSL VPN gateways to the public internet, reducing the attack surface.
Once the vendor provides an update, apply it immediately to any devices identified as running vulnerable software versions.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.